FYI, we noticed the following commit (built with gcc-5):

commit: 7cc622617a698b2ad91b74b59d967c707513a0ce ("keys: Network namespace domain tag")
https://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git keys-acl

in testcase: trinity
with following parameters:

	runtime: 300s

test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/


on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 4G

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):


+----------------------------------------------------------+------------+------------+
|                                                          | fb7b3faf7e | 7cc622617a |
+----------------------------------------------------------+------------+------------+
| boot_successes                                           | 30         | 4          |
| boot_failures                                            | 2          | 12         |
| IP-Config:Auto-configuration_of_network_failed           | 2          |            |
| WARNING:at_lib/refcount.c:#refcount_sub_and_test_checked | 0          | 12         |
| RIP:refcount_sub_and_test_checked                        | 0          | 12         |
+----------------------------------------------------------+------------+------------+



[  202.814406] WARNING: CPU: 0 PID: 5 at lib/refcount.c:187 refcount_sub_and_test_checked+0x185/0x29b
[  202.816665] CPU: 0 PID: 5 Comm: kworker/u2:0 Not tainted 5.0.0-rc3-00011-g7cc62261 #1
[  202.818388] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[  202.820214] Workqueue: netns cleanup_net
[  202.821143] RIP: 0010:refcount_sub_and_test_checked+0x185/0x29b
[  202.822427] Code: 01 00 00 00 48 c7 c7 98 4a bf 85 c6 05 48 28 ee 03 01 e8 ae 2f 69 ff 48 c7 c7 80 fc a9 83 48 ff 05 aa ce 45 04 e8 b5 a9 57 ff <0f> 0b b9 01 00 00 00 31 d2 be 01 00 00 00 48 c7 c7 68 4a bf 85 e8
[  202.826212] RSP: 0000:ffff88811a767c70 EFLAGS: 00010286
[  202.827363] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
[  202.828847] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffed10234ecf83
[  202.830342] RBP: 0000000000000001 R08: fffffbfff0badff1 R09: fffffbfff06d6079
[  202.831839] R10: fffffbfff0c0647f R11: fffffbfff0badff1 R12: 00000000ffffff01
[  202.833336] R13: 0000000000000000 R14: 0000000000000003 R15: 0000000000000001
[  202.834834] FS:  0000000000000000(0000) GS:ffffffff84a97000(0000) knlGS:0000000000000000
[  202.836618] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  202.837861] CR2: 000055a7e7a69cc8 CR3: 00000000b0731000 CR4: 00000000000406f0
[  202.839329] Call Trace:
[  202.840001]  ? refcount_inc_checked+0xdc/0xdc
[  202.841010]  ? dec_ucount+0x230/0x26e
[  202.841889]  ? inc_ucount+0x44b/0x44b
[  202.842770]  key_put_tag+0x10/0x4b
[  202.843609]  key_remove_domain+0x1a/0x50
[  202.844541]  cleanup_net+0x36b/0x3e3
[  202.845407]  ? net_drop_ns+0x6b/0x6b
[  202.846280]  ? finish_task_switch+0x4e0/0x5ab
[  202.847293]  ? ftrace_likely_update+0x2dd/0x30d
[  202.848330]  ? ftrace_likely_update+0x2dd/0x30d
[  202.849366]  process_one_work+0x43f/0x691
[  202.850313]  worker_thread+0x58c/0x724
[  202.851212]  ? process_scheduled_works+0x37/0x37
[  202.852256]  kthread+0x267/0x277
[  202.853058]  ? __kthread_bind_mask+0x35/0x35
[  202.854160]  ret_from_fork+0x1f/0x30
[  202.855020] ---[ end trace 9feac3b0410f7e0a ]---


To reproduce:

        git clone https://github.com/intel/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email



Thanks,
lkp